From 8900eec7aa1b97ab84f1a74e73f26a6b5a18ff27 Mon Sep 17 00:00:00 2001 From: Joshua Simpson Date: Sun, 18 Oct 2026 06:22:16 +0000 Subject: [PATCH 01/27] fix: address confirmed merged PR review findings --- docs/audit/2026-10-18-merged-pr-resolution.md | 74 ++ ...3f2bb4f33a3a4af98f30357f5e95995e.record.md | 1 + ...-10-17-wfydv6-stays-open-until-sign-off.md | 7 +- docs/governance-incident-runbooks.md | 71 +- docs/organisation/retired-rules.json | 2 +- docs/organisation/systems/knowledge.json | 1 + .../systems/personal-practice.json | 1 + .../14e2a5cd-4d1e-4c1b-8b85-f5e573fb6be7.json | 10 + .../2f15ec99-d824-4c5c-99e2-0801f58522d7.json | 13 + .../3d33317d-4a51-4a3f-ac76-5a85aa0c036e.json | 16 + .../82706397-5f18-49eb-904d-a308e9251b07.json | 13 + .../95bba750-da9d-4dc3-babd-36264d71cdc4.json | 10 + docs/worker-deploy-runbook.md | 8 + .../therapies.33b967775cd5fc39.json | 1 + scripts/check-cloud-platform-smoke.mjs | 11 +- scripts/ledger-inbox.mjs | 11 +- scripts/list-database-skills.mjs | 2 +- scripts/setup-codex-cloud.sh | 47 +- src/app/api/upload/route.ts | 13 + .../use-dashboard-bulk-actions.ts | 55 +- .../assessments/assessments-assessor.tsx | 1 - .../assessments/assessments-inbox.tsx | 5 +- .../assessments/assessments-term-overview.tsx | 14 +- .../record/source-provenance.tsx | 5 +- src/data/source-acquisitions.json | 7 +- src/data/therapies-index.json | 948 +++++++++++++++--- src/data/therapies-source.json | 22 +- src/data/therapy-catalogue-assets.ts | 2 +- src/lib/cme/training-assessments.ts | 16 +- src/lib/cme/training-repository.ts | 49 + src/lib/developer-area/sign-off-queue.ts | 33 +- src/lib/document-enrichment.ts | 146 +-- src/lib/ingestion-enqueue.ts | 12 +- src/lib/rag/rag-answer-quality-gate.ts | 25 +- src/lib/rag/rag-document-summary-context.ts | 2 +- src/lib/supabase/database.types.ts | 4 + .../assessments/supervisor-bookings.ts | 2 + src/lib/teaching/client.ts | 16 +- src/lib/therapy-source-governance.ts | 12 + ...55300_atomic_training_milestone_mirror.sql | 71 ++ supabase/schema.sql | 72 ++ ...inical-dashboard-bulk-actions.dom.test.tsx | 54 + tests/cloud-platform-smoke.test.ts | 20 +- .../cme-training-registrar-milestones.test.ts | 70 +- tests/codex-cloud-policy-harness.test.ts | 37 +- tests/codex-cloud-setup.test.ts | 38 +- ...ocument-enrichment-retrieval-scope.test.ts | 189 ++-- .../document-enrichment-visual-counts.test.ts | 50 +- tests/document-enrichment.test.ts | 19 +- tests/fixtures/empty.gitconfig | 1 + tests/helpers/document-metadata-fixture.ts | 85 ++ tests/ingestion-enqueue.test.ts | 74 +- tests/ledger-inbox.test.ts | 11 + tests/organisation-instruction-guards.test.ts | 9 + tests/rag-answer-fallback.test.ts | 10 +- tests/rag-document-summary.test.ts | 4 +- tests/sign-off-queue.test.ts | 38 +- tests/sign-off-today.test.ts | 8 +- ...ce-backed-recovery-cross-reference.test.ts | 70 +- ...ching-assessments-epa-answers.dom.test.tsx | 8 +- .../teaching-assessments-extras.dom.test.tsx | 23 +- tests/teaching-client.test.ts | 51 + tests/therapy-source-governance.test.ts | 27 + tests/upload-duplicate-cleanup-ledger.test.ts | 14 +- ...ork-bookings-concurrent-withdrawal.test.ts | 68 ++ tests/worker-control-plane-timeouts.test.ts | 5 +- worker/behavior.ts | 10 +- worker/main.ts | 32 +- 68 files changed, 2305 insertions(+), 551 deletions(-) create mode 100644 docs/audit/2026-10-18-merged-pr-resolution.md create mode 100644 docs/branch-review-records/e2c104cc7dff402a6ff932a489e08f2d3f2bb4f33a3a4af98f30357f5e95995e.record.md create mode 100644 docs/outstanding-issues-inbox/14e2a5cd-4d1e-4c1b-8b85-f5e573fb6be7.json create mode 100644 docs/outstanding-issues-inbox/2f15ec99-d824-4c5c-99e2-0801f58522d7.json create mode 100644 docs/outstanding-issues-inbox/3d33317d-4a51-4a3f-ac76-5a85aa0c036e.json create mode 100644 docs/outstanding-issues-inbox/82706397-5f18-49eb-904d-a308e9251b07.json create mode 100644 docs/outstanding-issues-inbox/95bba750-da9d-4dc3-babd-36264d71cdc4.json create mode 100644 public/therapy-compass-data/therapies.33b967775cd5fc39.json create mode 100644 supabase/migrations/20261018055300_atomic_training_milestone_mirror.sql create mode 100644 tests/clinical-dashboard-bulk-actions.dom.test.tsx create mode 100644 tests/fixtures/empty.gitconfig create mode 100644 tests/helpers/document-metadata-fixture.ts create mode 100644 tests/work-bookings-concurrent-withdrawal.test.ts diff --git a/docs/audit/2026-10-18-merged-pr-resolution.md b/docs/audit/2026-10-18-merged-pr-resolution.md new file mode 100644 index 0000000000..4e266d4a6d --- /dev/null +++ b/docs/audit/2026-10-18-merged-pr-resolution.md @@ -0,0 +1,74 @@ +# Merged-PR review: investigation and local remediation + +Task source: `PsychSift-Merged-PR-Review-2026-10-18-051421UTC.md`, supplied by the owner. Baseline: branch `work`, commit `5704fe8b7b30e993709e4b9ea161624cf9c5dae6` (PR #3630), initially clean. This checkout precedes the report's final two merges (#3631 and #3632). The findings below were checked against this checkout; the report's historical and already-fixed records are not newly reproduced defects. + +This is a local source repair and evidence receipt. Nothing was committed, pushed, merged, deployed, reconciled into the canonical ledger, or applied to a hosted database. No clinical, legal, cultural, security-image, physical-device or live-provider acceptance is supplied. Canonical Notion lifecycle reconciliation is unsynced; this receipt does not replace it. + +## Disposition of all 30 open findings + +| Finding | Verification and action | Remaining boundary | +| ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | +| PS-001 | Confirmed: the answer-quality recovery read selection-wide relevance and structure signals. Recovery now reads signals only from sources matching both the cited chunk and document IDs, and preserves low confidence. Missing cited sources cannot leave phantom citations on this failure path. Added uncited-source and valid-cited-source controls. | Local synthetic proof; no live answer evaluation. | +| PS-003 | The assessment-scroll test and its unchanged 2px tolerance exist. The report explicitly retains mixed historical evidence, including a later passing matrix. No current deterministic failure or causal CSS repair is established here. | Browser executables are absent; the installation CDN returned HTTP 403 `Domain forbidden`. Keep acceptance open; do not apply the historical 8px-reserve hypothesis without reproduction. | +| PS-005 | Confirmed profile ordering. The full inherited-provider scrub now precedes nvm loading and runtime selection. Added an nvm sentinel which rejects inherited synthetic provider names. | Local shell fixture; no installed-host activation proof. | +| PS-007 | Confirmed active hook/API mismatch. The actually imported dashboard hook now sends sequential batches of at most ten, totals successful/failed results, and refreshes successfully queued work even if a later batch fails. Tests cover 10/11/23 selections and partial failure. | Local hook tests; no real reindex request. | +| PS-008 | Confirmed limitation: one successful device marks the whole opening delivered, and the claim is process-local. No delivery-guarantee change was made: changing only the aggregate success predicate would resend already-delivered alerts without providing durable per-device retry state. | Still open. A complete repair needs durable device-level delivery records, atomic expiring claims, a retry consumer and explicit at-least-once semantics for the send/ack crash window. Existing real-staff release controls remain. | +| PS-009 | Confirmed edited lithium metadata retained the September attestation. Withdrew the stale attestation, changed validation to `unverified`, retained candidate disposition and recorded why re-review is needed. | No replacement signature or clinical approval was invented. | +| PS-010 | Confirmed early replay bypassed cleanup after a committed recovery sibling. Durable replay now retries release of the intended path against the path in the committed admission, reusing the existing scoped/equal-path fences and cleanup-ledger fallback. | Recovery is replay-driven; no claim of autonomous cleanup if the caller never retries. | +| PS-012 | Confirmed fixture mechanisms. Replaced the Windows-invalid null-config device with a repository empty-config fixture; native-Windows synthetic-checkout fixtures explicitly bind their Git shim. | Native Windows execution is unavailable; Linux fixtures cannot close Windows acceptance. | +| PS-025 | Confirmed successful metadata RPC payloads omit the stamps required to validate summaries. Related metadata now always reads source rows and checks their committed generation. Indexed-parent, owner and explicit-public-corpus admission are retained. Staged/hidden rows and unadmitted parents cannot supply metadata; legacy unstamped rows remain compatible. | No live database/RPC execution. | +| PS-026 | Confirmed the trigger can overwrite the caller's timestamp. Enqueue reads `updated_at` back from the queue UPDATE and uses that stored value for compensation. Statement-level tests model a replacing trigger, both collision branches and an intervening newer write. | No production race reproduced. Read-back fixes the reported caller/trigger mismatch, not every queue-insertion atomicity concern. | +| PS-027 | Confirmed SQL equality excluded legacy NULL generations before the 40-row cap. The query now admits NULL or the committed generation before ordering/limiting; wrong stamped generations remain rejected. | Local query/summary fixtures; no corpus reindex. | +| PS-029 | Confirmed the extractor intentionally admits ambiguous lowercase/bullet/numeric continuations and some multi-column bands. The report itself documents the opposing risk of dropping real continuations (PS-028). | Still open as a bounded extraction limitation. No general geometry change without representative native PDFs and table/text-retention acceptance; a note-phrase blacklist would not repair row association generally. | +| PS-034 | Confirmed 120s shared transport cap and 30s data-write callbacks. The default transport budget now covers configured control/data budgets (240s by default); explicit operator overrides remain explicit caps. Image/managed-terminal RPC callbacks select the control or data budget by RPC identity. | No live worker/provider execution. | +| PS-035 | Confirmed runbook table/column mismatch, plus invalid document-status update examples. Feedback queries now use `rag_answer_feedback`; quarantine uses the existing transactional `record_source_review` RPC and metadata governance fields. Railway service names match repository deployment instructions. | SQL examples were checked against repository contracts, not executed against production. | +| PS-036 | Confirmed unbounded fallback and discarded exit status. Missing GNU timeout now fails with an actionable prerequisite error; tool acceptance requires a successful bounded probe before version parsing. Added failed-tool, missing-timeout and printed-version/timeout controls. | Shell fixtures cover version probes, not full host installation. | +| PS-037 | Confirmed Today-rule ledger/runtime mismatch. Ledger classification now calls the runtime fatigue/CPD `ruleGate` and `mhaTimerGate`. Added stale-hash, unapproved-signer and future-time controls. | Classification changes grant no sign-off authority. | +| PS-043 | Confirmed wording-only mismatch. The collision diagnostic derives its reviewed-twin list from `CROSS_SURFACE_NAME_TWINS`. | No validator policy changed. | +| PS-044 | Confirmed the supplied #3570 branch label disagrees with the immutable local receipt. Appended a correction identifying the supplied proper branch and the unchanged head/merge SHAs, preserving the original receipt and its historical proof boundary. | Partial: no fresh GitHub metadata or complete replay of all historical landed proofs. The wider provenance task remains open. | +| PS-047 | Confirmed separate CME/mirror writes. Drafted `mutate_owner_training_milestone`, a service-role-only transaction for create/update/delete, with owner locking, row-limit checks and registrar-only record preservation. Production clients use the RPC and never fall back to two writes after an RPC error. Table-only legacy test doubles retain their separate-write fixture path. | **Database draft, not applied. Merge only after explicit owner approval of this database change/window.** Local PostgreSQL/PGlite rollback/tenancy tests passed. Full pinned Supabase replay and drift-manifest regeneration are blocked by Docker-daemon storage exhaustion; the existing manifest has deliberately not been resealed or hand-forged. | +| PS-048 | Confirmed unfiltered EPA attainments. Only attainments inside the current rotation and no later than today count; undated records remain in progress. With no current rotation, historical attainments receive no current-rotation credit. Added date-boundary controls. | No training policy/minimum changed. | +| PS-049 | Confirmed automatic withdrawal lacked a stale-state fence. It now requires the original open DB status and `updated_at`. A statement-level interleaving test books the published slot before withdrawal and verifies that booking survives. | Local concurrency simulation; no hosted incident reproduced. | +| PS-050 | Confirmed NICE classification used incidental publisher text/links. Explicit citation authority now governs classification; PubMed/RANZCP citations mentioning NICE remain generic references. Added mixed-authority controls. | Source designation is not evidence appraisal or clinical approval. | +| PS-051 | Confirmed the 2025 review has no authors/title/stable identifier. Removed that unverifiable citation from the CET reference copies and recorded its exclusion pending bibliographic verification. Regenerated the catalogue and content-addressed browser asset. | CET remains `needs_review`; no substitute reference or clinical appraisal was invented. | +| PS-055 | Confirmed native-disabled actions prevented focus on their described reasons. EPA submit, inbox send and reminder controls now retain keyboard focus with `aria-disabled`; their handlers block activation. Tests verify focus, accessible reasons and blocked actions. | DOM proof; no assistive-technology/physical-device acceptance. This checkout predates #3632's shared Button guard, so explicit local handler guards are necessary. | +| PS-056 | Confirmed identical Teaching URLs used raw fetches. Teaching reads now use the existing account-epoch-aware shared GET transport, retaining independent cancellation and no persistent cache. Added coalescing/cancellation proof and retained account-switch tests. | No production request-count measurement. | +| PS-057 | Confirmed ambient Git selectors reached mutating smoke commands. All fixture/bootstrap children now drop Git selectors and use an isolated real config file plus `GIT_CONFIG_NOSYSTEM`. A regression supplies repository/index/config redirection and verifies the caller index survives. | Local smoke fixture; no native Windows/host forwarding acceptance. | +| PS-062 | Confirmed canonical clinical-completion prose contradicts the reset source, and the archived non-outcome update will not reopen it. Queued cancellation of that ineffective pending update, a current-fingerprint reopen of NZ4X41, and a Z3GZ5P correction retaining DID as pending and the count at 515. | Queued only. Canonical reconciliation requires its serialized fresh-base workflow; the canonical ledger was not directly edited. | +| PS-063 | Confirmed prefix-collision identity gap. Reopen rejects an explicit display ID owned by another ULID before lookup can rewrite it. Full-ULID CLI targets resolve the actual extended row ID. Added a two-row collision regression. | Local synthetic ledger; no canonical reconciliation executed. | +| PS-064 | Confirmed present-tense completion claim. The WFYDV6 decision now describes the reopen/fold-back as queued and pending reconciliation. | The forms' owner/legal/clinical hold remains. | +| PS-067 | Confirmed overbroad retired-rule matcher. It now targets the obsolete missing-reference rationale and permits a current pending-owner-signature hold. Added positive/negative wording controls. | Clinical hold unchanged. | + +## Validation and handoff + +Fresh results (2026-10-18); the runs overlap and must not be summed as independent tests: + +| Check | Result | +| ------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Focused behavioral suite, 32 files | **855 passed**. | +| Final affected RAG/shell files, after adding the cited-required-signal control | **261 passed**, overlapping the preceding suite. | +| Trusted-admission and cleanup helpers | **36 passed**. | +| TypeScript compilation | **Passed**, fresh run covering the changed type contracts. | +| Repository ESLint, zero warnings allowed | **Passed**, fresh run; the initial unused RPC type warning was fixed. | +| PostgreSQL/PGlite transaction fixture | **13 scenarios passed**. | +| Migration role, function grants and owner-scope checks | **Passed**; no hosted calls. | +| Clinical hazard controls | **Passed with the existing 12 drift exceptions retained**, not renewed clinical approval. | +| Offline production-readiness CI check | **Passed** for repository structure; missing live evidence/configuration remains explicitly unverified. | +| Organisation, instruction rules/budgets, branch-review ledger, outstanding-issue structure/snapshot, documentation links | **Passed**. The known ineffective old cancellation is reported; the new reopen request supplies its correction path. | +| Changed-file formatting and whitespace | **Passed**. | +| Diff integrity | **Passed**, 602 → 627 cases in 21 changed test files, including new files, against the actual starting commit `5704fe8b7`; the default command could not resolve absent local `main`/`origin/main` refs, so its documented explicit-base option was used. | +| Browser execution | **Blocked**: no installed executables; browser CDN denied downloads. | +| Full pinned Supabase schema replay / drift-manifest generation | **Blocked**: image extraction exhausted Docker-daemon storage; the required image is not cached. The existing drift manifest is stale against the draft schema and was left unchanged. | +| Migration immutability/sealing gate | **Blocked on the new, unsealed draft migration only**. Existing migration hashes are unchanged. No sealing/production authorization is inferred from this task. | + +Earlier failed runs were diagnostic, not passing evidence. Full hosted CI, provider canaries and production/device acceptance were not run. Commit/PR ledger-write discipline was not presented as passing: that gate requires committed refs, whereas all task changes are intentionally uncommitted. + +The final citation-metadata follow-up also passed **25 tests in two files**, overlapping the 32-file suite and covering explicit mixed NICE/PubMed/APA authority markers. The final lint run passed after that edit. + +The PostgreSQL/PGlite fixture used a fresh in-memory database, the table definitions extracted from the repository migrations and the actual new migration. It exercised failed mirror inserts/updates/deletes rolling back CME state, foreign-owner mutation rejection, successful create/update/delete, registrar-only code/stage preservation the row-limit guard, cross-owner mirror-ID collision rollback and authenticated-role denial. Harness: `/tmp/psychsift-pg-validation/validate.mjs`; output: `/tmp/psychsift-pg-validation.log`. This is real PostgreSQL execution through PGlite, not the pinned Supabase image, full migration-chain replay or a two-session race. + +The pinned Supabase image pull failed while registering a layer (`no space left on device`). Docker reported no retained images, containers or volumes afterward. No unrelated Docker cleanup was performed. The browser CDN explicitly denied downloads, so neither scroll acceptance nor browser accessibility is claimed. + +The database draft must not merge while its schema mirror/drift manifest replay remains incomplete. No historical migration hash, drift allowlist, clinical signature, or immutable review receipt was rewritten. + +The task-started local development server was stopped after browser installation was denied. No task-owned server or container remains running. The final source changes are uncommitted on `work`; the private checkpoint and receipt handoff remain local and do not update Notion. diff --git a/docs/branch-review-records/e2c104cc7dff402a6ff932a489e08f2d3f2bb4f33a3a4af98f30357f5e95995e.record.md b/docs/branch-review-records/e2c104cc7dff402a6ff932a489e08f2d3f2bb4f33a3a4af98f30357f5e95995e.record.md new file mode 100644 index 0000000000..42d5059851 --- /dev/null +++ b/docs/branch-review-records/e2c104cc7dff402a6ff932a489e08f2d3f2bb4f33a3a4af98f30357f5e95995e.record.md @@ -0,0 +1 @@ +| 2026-10-18 | claude/reconcile-ledger-20261016 | fa526775c6ca0751f9609e4fc5133190efa19c16 | PS-044 provenance correction for PR #3570 | Corrects the branch label in a7be2760026da4bc040fa90bf847382bdcded2a8a7510ceaf7be4ac49c042211.record.md: the supplied review identifies claude/reconcile-ledger-20261016, final head d8eefbb91e9e623fcdb9029fade9f3eda661091e and merge fa526775c6ca0751f9609e4fc5133190efa19c16. Original immutable record retained. This correction does not re-run or extend its landed proof. | Compared supplied PS-044 correction with the local immutable receipt; no new GitHub request, patch-id execution, CI or deployment verification. | diff --git a/docs/decisions/2026-10-17-wfydv6-stays-open-until-sign-off.md b/docs/decisions/2026-10-17-wfydv6-stays-open-until-sign-off.md index 1fd994b802..cd7bfcca9f 100644 --- a/docs/decisions/2026-10-17-wfydv6-stays-open-until-sign-off.md +++ b/docs/decisions/2026-10-17-wfydv6-stays-open-until-sign-off.md @@ -7,9 +7,10 @@ PR #3609 archived ledger issue #WFYDV6 (the unwired `src/components/forms/wa-mha unverified statutory text) without the legal and clinical sign-off the issue required. The owner decided on 17 Oct 2026 at 21:37 AWST that the issue stays open and the form stays unwired until that sign-off is recorded. The Form 6A/6B wording still needs owner, legal and clinical sign-off; nothing in this decision signs it off. At first the ledger tooling had no reopen action, so the issue was tracked again as a new open P1 row -(#Z12CBC). Once the reopen action landed (#3627), a ledger inbox `reopen` request moved #WFYDV6 itself back to the -open table as a P1 with its original ID and ULID. #Z12CBC, and the duplicate sign-off tracker #BDFFYF, were closed as -folded into it, so the issue keeps one identity. A reconciliation must not archive #WFYDV6 again without the recorded owner, legal and clinical sign-off, or the deletion of the file after the +(#Z12CBC). Once the reopen action landed (#3627), inbox requests were queued to reopen #WFYDV6 as a P1 +with its original ID and ULID and fold #Z12CBC and #BDFFYF back into it. These requests have not +yet been reconciled: the canonical ledger still archives #WFYDV6 and keeps the duplicate trackers open. +The queued fold-back is a pending transaction, not completed work. A reconciliation must not archive #WFYDV6 again without the recorded owner, legal and clinical sign-off, or the deletion of the file after the 30-day dead-code window (13 Nov 2026). If this summary and the source ever differ, the source wins. diff --git a/docs/governance-incident-runbooks.md b/docs/governance-incident-runbooks.md index 9a35b2dad7..d90d50d8ce 100644 --- a/docs/governance-incident-runbooks.md +++ b/docs/governance-incident-runbooks.md @@ -1,6 +1,6 @@ # Clinical governance incident runbooks -Last reviewed: 2026-10-16 +Last reviewed: 2026-10-18 (repository contracts; not live execution) These are short operator checklists. Preserve evidence and identifiers, but do not copy patient-identifying question or answer prose into tickets or chat. @@ -14,23 +14,28 @@ These are short operator checklists. Preserve evidence and identifiers, but do n 1. Record the answer interaction ID, feedback category, cited source IDs, time, and affected workflow: ```sql - SELECT id, created_at, feedback_category, cited_document_ids, config_posture_version - FROM public.rag_query_feedback - WHERE id = ''; + SELECT id, interaction_id, created_at, feedback_category, cited_source_ids, source_ids + FROM public.rag_answer_feedback + WHERE interaction_id = ''::uuid; ``` 2. If harm is plausible, disable the affected answer mode or narrow its source scope; keep direct source browsing available: ```bash # Switch answer generation to deterministic offline/source-only mode immediately - railway variables --service clinical-kb-app --set "RAG_PROVIDER_MODE=offline" + railway variables --service PsychSift --set "RAG_PROVIDER_MODE=offline" # Pause background worker ingestion/enrichment claims if source mutation is in flight - railway variables --service clinical-kb-worker --set "WORKER_PAUSED=true" + railway variables --service worker --set "WORKER_PAUSED=true" ``` 3. Quarantine an implicated source through a `decommissioned` or `superseded` source-review event when appropriate: ```sql - UPDATE public.documents - SET source_review_status = 'decommissioned', - updated_at = timezone('utc', now()) - WHERE id = ''; + -- The reviewer must own the document. This existing RPC locks the row, + -- appends source_review_events, and updates its governance metadata atomically. + SELECT public.record_source_review( + p_document_id => ''::uuid, + p_reviewer_id => ''::uuid, + p_decision => 'decommissioned', + p_reason => '', + p_evidence_references => ARRAY[''] + ); ``` 4. Reproduce with a synthetic or minimised fixture, add a regression test, and identify whether retrieval, generation, rendering, or copy caused the defect: ```bash @@ -45,31 +50,21 @@ These are short operator checklists. Preserve evidence and identifiers, but do n ```sql BEGIN; - INSERT INTO public.document_governance_events ( - document_id, - event_type, - review_status, - reason, - replacement_document_id - ) VALUES ( - '', - 'quarantine', - 'decommissioned', - '', - NULLIF('', '') + -- The reviewer must own the document. This existing RPC locks the row, + -- appends source_review_events, and updates its governance metadata atomically. + SELECT public.record_source_review( + p_document_id => ''::uuid, + p_reviewer_id => ''::uuid, + p_decision => 'decommissioned', + p_reason => '', + p_evidence_references => ARRAY[''] ); - - UPDATE public.documents - SET source_review_status = 'decommissioned', - updated_at = timezone('utc', now()) - WHERE id = ''; - COMMIT; ``` 2. If immediate containment is required, disable the affected answer mode or narrow its source scope; do not treat review status alone as a retrieval exclusion: ```bash - railway variables --service clinical-kb-app --set "RAG_PROVIDER_MODE=offline" - railway variables --service clinical-kb-worker --set "WORKER_PAUSED=true" + railway variables --service PsychSift --set "RAG_PROVIDER_MODE=offline" + railway variables --service worker --set "WORKER_PAUSED=true" ``` 3. Confirm answer caches for the owner are invalidated after the transaction commits: ```sql @@ -77,18 +72,18 @@ These are short operator checklists. Preserve evidence and identifiers, but do n WHERE owner_id = '' OR payload::text LIKE '%%'; ``` -4. Before declaring containment, verify the source remains directly browsable (`source_review_status = 'decommissioned'`), that retrieval exclusion is active (`RAG_PROVIDER_MODE=offline` or zero active retrieval chunks for the quarantined `document_id`), and that `rag_response_cache` contains zero entries referencing the quarantined document: +4. Before declaring containment, verify the source remains directly browsable (`metadata->>'governance_disposition' = 'decommissioned'`), that retrieval exclusion is active (`RAG_PROVIDER_MODE=offline` or zero active retrieval chunks for the quarantined `document_id`), and that `rag_response_cache` contains zero entries referencing the quarantined document: ```sql SELECT d.id, d.title, - d.source_review_status, + d.metadata->>'governance_disposition' AS governance_disposition, d.metadata->>'rag_indexed' AS rag_indexed, (SELECT count(*) FROM public.document_chunks c WHERE c.document_id = d.id) AS chunk_count, (SELECT count(*) FROM public.rag_response_cache r WHERE r.payload::text LIKE '%' || d.id::text || '%') AS cached_answer_count FROM public.documents d WHERE d.id = ''; ``` - Confirm via `railway variables --service clinical-kb-app` (or a probe query against `/api/ask`) that the quarantined `document_id` is not returned in retrieval citations before lifting `RAG_PROVIDER_MODE=offline`. + Confirm via `railway variables --service PsychSift` (or a probe query against `/api/ask`) that the quarantined `document_id` is not returned in retrieval citations before lifting `RAG_PROVIDER_MODE=offline`. 5. Re-run source-governance and focused answer tests. Live data repair or migration requires explicit approval (if the primary owner is unavailable, the backup operator must leave the source quarantined and `rag_response_cache` purged until explicit approval is obtained): ```bash npm run audit:source-governance @@ -106,12 +101,12 @@ These are short operator checklists. Preserve evidence and identifiers, but do n ``` 2. Disable provider generation or switch to the source-only path if external processing must stop: ```bash - railway variables --service clinical-kb-app --set "RAG_PROVIDER_MODE=offline" - railway variables --service clinical-kb-worker --set "WORKER_PAUSED=true" + railway variables --service PsychSift --set "RAG_PROVIDER_MODE=offline" + railway variables --service worker --set "WORKER_PAUSED=true" ``` 3. If raw query persistence, answer persistence, or provider response storage is enabled, disable the affected path. Verify all three controls are off before proceeding: ```bash - railway variables --service clinical-kb-app \ + railway variables --service PsychSift \ --set "RAG_PERSIST_RAW_QUERY_TEXT=false" \ --set "RAG_PERSIST_ANSWER_TEXT=false" \ --set "OPENAI_STORE_RESPONSES=false" @@ -130,8 +125,8 @@ These are short operator checklists. Preserve evidence and identifiers, but do n 1. Revert or disable the smallest affected generation or ranking feature while retaining source browsing and deterministic source-only answers: ```bash - railway variables --service clinical-kb-app --set "RAG_PROVIDER_MODE=offline" - railway variables --service clinical-kb-worker --set "WORKER_PAUSED=true" + railway variables --service PsychSift --set "RAG_PROVIDER_MODE=offline" + railway variables --service worker --set "WORKER_PAUSED=true" ``` Verify `/api/health` (`deploymentCommitSha`) and worker `/health` (`claimLoopPaused: true`, `deploymentCommitSha`) confirm the active release and paused worker loop: ```bash diff --git a/docs/organisation/retired-rules.json b/docs/organisation/retired-rules.json index 8fcaee72ed..bf07852d33 100644 --- a/docs/organisation/retired-rules.json +++ b/docs/organisation/retired-rules.json @@ -85,7 +85,7 @@ "id": "wake-therapy-needs-review-hold", "retired": "2026-10-17", "summary": "Wake therapy (sleep deprivation / chronotherapy) now carries governed clinical references in src/data/therapies-source.json, so the hold until it had references no longer applies. Its 17 Oct sign-off was reset by owner ruling (17 Oct 2026 22:12 AWST; docs/decisions/2026-10-17-agent-recorded-therapy-and-did-sign-offs-reset.md), so it is needs_review only until the owner signs it with therapy:review.", - "pattern": "wake-therapy-sleep-deprivation-chronotherapy[^.\\n]{0,80}(must remain|stays|held in) `?needs_review`?", + "pattern": "wake-therapy-sleep-deprivation-chronotherapy[^.\\n]{0,80}(must remain|stays|held in) `?needs_review`?[^.\\n]{0,120}(missing references|no references|lacks references|until (it has (governed |clinical )?references|references (are|have)))", "allowedContext": "no longer|retir(ed|ement)|removed|formerly|previously|superseded|dropped|replaced|historical|rather than", "decision": "docs/decisions/2026-10-17-remaining-therapy-compass-sign-offs.md" }, diff --git a/docs/organisation/systems/knowledge.json b/docs/organisation/systems/knowledge.json index 42642993cd..1d69f412a8 100644 --- a/docs/organisation/systems/knowledge.json +++ b/docs/organisation/systems/knowledge.json @@ -136,6 +136,7 @@ "tests/cursor-mcp-contract.test.ts", "tests/database-skills.test.ts", "tests/docs-*", + "tests/fixtures/empty.gitconfig", "tests/github-shell-access.test.ts", "tests/instruction-continuation-guards.test.ts", "tests/issues-report.test.ts", diff --git a/docs/organisation/systems/personal-practice.json b/docs/organisation/systems/personal-practice.json index f2238d8732..7e93311eb2 100644 --- a/docs/organisation/systems/personal-practice.json +++ b/docs/organisation/systems/personal-practice.json @@ -106,6 +106,7 @@ "tests/ui-cme-phone.spec.ts", "tests/ui-on-*", "tests/ui-teaching.spec.ts", + "tests/work-bookings-concurrent-*", "tests/work-calendar-booking-feed.test.ts", "tests/work-calendar-entries.test.ts", "tests/work-page-favourite-visibility.dom.test.tsx", diff --git a/docs/outstanding-issues-inbox/14e2a5cd-4d1e-4c1b-8b85-f5e573fb6be7.json b/docs/outstanding-issues-inbox/14e2a5cd-4d1e-4c1b-8b85-f5e573fb6be7.json new file mode 100644 index 0000000000..0d7a14c096 --- /dev/null +++ b/docs/outstanding-issues-inbox/14e2a5cd-4d1e-4c1b-8b85-f5e573fb6be7.json @@ -0,0 +1,10 @@ +{ + "version": 2, + "id": "14e2a5cd-4d1e-4c1b-8b85-f5e573fb6be7", + "createdOn": "2026-10-18", + "action": "cancel", + "payload": { + "requestId": "2f15ec99-d824-4c5c-99e2-0801f58522d7", + "reason": "PS-062: superseded by a correction that includes the full prior worklist/detail as dated history, rather than replacing it with a short summary." + } +} diff --git a/docs/outstanding-issues-inbox/2f15ec99-d824-4c5c-99e2-0801f58522d7.json b/docs/outstanding-issues-inbox/2f15ec99-d824-4c5c-99e2-0801f58522d7.json new file mode 100644 index 0000000000..3026e96a2d --- /dev/null +++ b/docs/outstanding-issues-inbox/2f15ec99-d824-4c5c-99e2-0801f58522d7.json @@ -0,0 +1,13 @@ +{ + "version": 2, + "id": "2f15ec99-d824-4c5c-99e2-0801f58522d7", + "createdOn": "2026-10-18", + "action": "update", + "payload": { + "id": "#Z3GZ5P", + "summary": "DSM-5-TR specifier catalogue: 515 of 585 items await clinician review, including the reset DID possession-form item", + "detail": "PS-062 correction verified 2026-10-18: the owner reset the DID possession-form sign-off under docs/decisions/2026-10-17-agent-recorded-therapy-and-did-sign-offs-reset.md. The previous statement that all 71 written disorder-specific items were signed is superseded: 70 remain signed and one written DID item plus 514 unwritten placeholders await review (515 pending). The 18 universal specifiers remain separate. Preserve all earlier worklist and clinician-only acceptance requirements; no new clinical approval is supplied.", + "baseRowFingerprint": "4d06e751ebc35fa92082f662f62fdf7b5d000d3e6bacf75bce1ed246e93dc09b", + "targetUlid": "01M1XS1N1YZ3GZ5PDNEACPWDY8" + } +} diff --git a/docs/outstanding-issues-inbox/3d33317d-4a51-4a3f-ac76-5a85aa0c036e.json b/docs/outstanding-issues-inbox/3d33317d-4a51-4a3f-ac76-5a85aa0c036e.json new file mode 100644 index 0000000000..0f28fb6bbe --- /dev/null +++ b/docs/outstanding-issues-inbox/3d33317d-4a51-4a3f-ac76-5a85aa0c036e.json @@ -0,0 +1,16 @@ +{ + "version": 2, + "id": "3d33317d-4a51-4a3f-ac76-5a85aa0c036e", + "createdOn": "2026-10-18", + "action": "reopen", + "payload": { + "id": "#NZ4X41", + "pri": "P2", + "detail": "PS-062 verified against the 2026-10-18 checkout: 179 therapies remain reviewed and 26 were reset to needs_review under the owner ruling recorded in docs/decisions/2026-10-17-agent-recorded-therapy-and-did-sign-offs-reset.md. The previous completion described all 205 as signed; that outcome is superseded. Governed references are present, but the 26 need genuine owner review through therapy:review. Clinical approval, corpus refresh and loaded-client revocation are not established.", + "source": "PS-062 supplied merged-PR review; canonical therapies-source.json and reset decision, inspected 2026-10-18", + "baseRowFingerprint": "443d1f1bbc33c4bd4036c922e109c0c80400342c910618c8fa8b9b79ac35ff32", + "allowArchived": true, + "targetTable": "archive", + "targetUlid": "01M488JH90NZ4X41FZT2339F40" + } +} diff --git a/docs/outstanding-issues-inbox/82706397-5f18-49eb-904d-a308e9251b07.json b/docs/outstanding-issues-inbox/82706397-5f18-49eb-904d-a308e9251b07.json new file mode 100644 index 0000000000..6f81b80c8f --- /dev/null +++ b/docs/outstanding-issues-inbox/82706397-5f18-49eb-904d-a308e9251b07.json @@ -0,0 +1,13 @@ +{ + "version": 2, + "id": "82706397-5f18-49eb-904d-a308e9251b07", + "createdOn": "2026-10-18", + "action": "update", + "payload": { + "id": "#Z3GZ5P", + "summary": "DSM-5-TR specifier catalogue: 515 of 585 items await clinician review, including the reset DID possession-form item", + "detail": "PS-062 correction verified 2026-10-18: the owner reset the DID possession-form sign-off under docs/decisions/2026-10-17-agent-recorded-therapy-and-did-sign-offs-reset.md. The previous statement that all 71 written disorder-specific items were signed is superseded: 70 remain signed and one written DID item plus 514 unwritten placeholders await review (515 pending). The 18 universal specifiers remain separate. Preserve all earlier worklist and clinician-only acceptance requirements; no new clinical approval is supplied. PRIOR DETAIL retained as superseded historical context (its all-signed/514-pending prose is corrected above): UPDATE 2026-10-17: All 71 written disorder-specific specifier items and 18 universal specifiers are signed off by Psych Sift with SHA-256 content pins (including the updated Dissociative Identity Disorder possession-form specifier wording); 514 unwritten catalog placeholders remain. PRIOR DETAIL (restored 2026-10-09, an earlier update replaced it wholesale): UPDATE 2026-09-25 (offline traversal of data/specifiers-content.json; no provider access). Two corrections to this row's own headline, both reproducible from the committed file. FIRST: '71 source-verified' overstates the work. 57 of the 71 restate their own label, matching 'For ,